Dutchess Community CollegeHigher Education

CORRECTIVE ACTION PLAN Federal Award Findings and Questioned Costs Finding 2023-001 Student Financial Aid Cluster: Assistance Listing #84.007 Federal Supplemental Educational Opportunity Grants Assistance Listing #84.033 Federal Work-Study Program Assistance Listing #84.063 Federal Pell Grant Program Assistance Listing #84.268 Federal Direct Student Loans Assistance Listing #93.364 Nursing Student Loans Federal agency – U.S. Department of Education Grant Period – Year ended August 31, 2023 Compliance Requirement: Special Tests and Provisions Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) (GLBA) requires the College, on an annual basis, to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer (student) information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, the GLBA risk assessment should include consideration of risk in each relevant area of operations, including: Employee training and management. Information systems, including network and software design, as well as information processing, storage, transmission, and disposal. Detecting, preventing, and responding to attacks, intrusions, or other system failures. Condition: During our testing, we noted the following: While the IT Systems Team is the assigned resource for information security matters, the College communicated that it does not have a single qualified individual designated with the responsibility for implementing and enforcing the College’s information security program. An annual IT risk assessment was not performed. A vendor management program is not in place. Mobile device management is not in place. Backup media is not encrypted. A full set of policies and procedures is not in place. Cause: The expected documentation supporting the required controls to adequately confirm compliance with GLBA safeguards was not complete. Effect: Without demonstrable, documented controls supporting compliance with the GLBA standards for safeguarding the protected data, compliance with the law and the requirements in the federal PPA may not be assured. Context: Inquiry and observation of the information received from the College related to compliance with GLBA. Recommendation: The College should review the GLBA safeguarding rules and as soon as practical implement and document the controls necessary for compliance with the rule, focusing on the completion of a documented, thorough, and standardized risk assessment and management reporting framework. The College should perform comprehensive risk assessments on a regular basis, which is suggested to be at least annually, and at any significant change in infrastructure or business process. Contact Person Responsible for Corrective Action Plan: Donna Rocap, Associate Vice President of Administration Corrective Action Plan: The College agrees with the findings and is in process of developing a corrective action plan to address. In addition, the College has made it a top priority to hire both a Chief Information Officer and a Chief Information Security Officer but has experienced difficulty getting a qualified pool of candidates. Timing of Planned Corrective Action: The College expects to resolve this finding during its August 31, 2024 fiscal year.

U.S. Department of Education Student Financial Aid Cluster: CFDA 84.007 Federal Supplemental Educational Opportunity Grants CFDA 84.033 Federal Work-Study Program CFDA 84.063 Federal Pell Grant CFDA 84.268 Federal Direct Student Loans Federal agency ? U.S. Department of Education Grant Period ? Year ended August 31, 2020 Compliance Requirement: Special Tests and Provisions Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) (GLBA) requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance to be financial institutions and subject to GLBA. This finding is based on the requirements for educational institutions participating in the federal awards and education loan program to meet the Federal Trade Commission?s GLBA Safeguards Rule (Title 16, Chapter I, Subchapter C, Part 314). Condition and Effect: The College has performed a high-level assessment for a number of common information security controls. However, the assessment lacks the expected risk assessment framework and scoring of risk likelihood and impact for all in scope systems, vendors, and data sets. Cause: The expected documentation supporting the required controls to adequately confirm compliance with GLBA safeguards was not complete. Effect: Without demonstrable, documented controls supporting compliance with the GLBA standards for safeguarding the protected data, compliance with the law and the requirements in the federal PPA may not be assured. Context: Inquiry and observation of the information received from the College related to compliance with GLBA. Recommendation: The College should review the GLBA safeguarding rules and as soon as practical implement and document the controls necessary for compliance with the rule, focusing on the completion of a documented, thorough, and standardized risk assessment and management reporting framework. The College should perform comprehensive risk assessments on a regular basis, which is suggested to be at least annually, and at any significant change in infrastructure or business process. Contact Person Responsible for Corrective Action Plan: Provost View of responsible officials: The College is currently in the process of developing the procedures and controls recommended by the auditors.

2019-001

Student Financial Aid Cluster: CFDA 84.007 Federal Supplemental Educational Opportunity Grants CFDA 84.033 Federal Work-Study Program CFDA 84.063 Federal Pell Grant CFDA 84.268 Federal Direct Student Loans Federal agency ? U.S. Department of Education Grant Period ? Year ended August 31, 2019 Compliance Requirement: Special Tests and Provisions Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) (GLBA) requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance to be financial institutions and subject to GLBA. This finding is based on the requirements for educational institutions participating in the federal awards and education loan program to meet the Federal Trade Commission?s GLBA Safeguards Rule (Title 16, Chapter I, Subchapter C, Part 314). Condition and Effect: The College has performed a high-level assessment for a number of common information security controls. However, the assessment lacks the expected risk assessment framework and scoring of risk likelihood and impact for all in scope systems, vendors, and data sets. Cause: The expected documentation supporting the required controls to adequately confirm compliance with GLBA safeguards was not complete. Effect: Without demonstrable, documented controls supporting compliance with the GLBA standards for safeguarding the protected data, compliance with the law and the requirements in the federal PPA may not be assured. Context: Inquiry and observation of the information received from the College related to compliance with GLBA. Recommendation: The College should review the GLBA safeguarding rules and as soon as practical implement and document the controls necessary for compliance with the rule, focusing on the completion of a documented, thorough, and standardized risk assessment and management reporting framework. The College should perform comprehensive risk assessments on a regular basis, which is suggested to be at least annually, and at any significant change in infrastructure or business process. Contact Person Responsible for Corrective Action Plan: Provost View of responsible officials: The College is currently in the process of developing the procedures and controls recommended by the auditors. The process is expected to be completed by August 31, 2020.